Tal,
Have you confirmed that this is indeed a problem with wincap on wintel
SMP? Although you stated you werent intending to slander Snort, it kinda
sounded like that in the latter parts of your email. I havent personally
used Snort on anything but Linux, be rest assured it works well, and at
least in Linux, it supports SMP just fine (I run it on a Quad Xeon box)
Honestly if you are set on running a lightweight IDS on Win32, and dont
want to buy a commercial product, I dont what other product you can use.
Now might be a good time to setup a nice Linux box.
Eric Joe
> Subject: [Snort-users] I find it odd that this product would not be
> supported for SMP win2k machines
>> I am working with SNORT with my win2k for few weeks now, only realizing
> it is not working on SMP machines with windows installments few days
> ago.
> I was reading a lot of good reviews of this open source and I even
> stumbled over a comparative analysis with the other tools currently
> available on the market.
> I must say that although the problem originate from the winpcap usage
> and not from any SNORT specific code, this problem raise a big question
> mark as for the validity of using SNORT for windows (random blue
> screens or forcing the usage of only one processor are not acceptable
> solutions imho).
> I am not trying to criticize SNORT nor do I intend to slander it. I am
> just stating my disbelief that a product which for many seems a
> standard would not support SMP with windows.
> Do you guys have any plans for replacing the winpcap library? Help in
> fixing the winpcap SMP problems? Support any other packet capturing
> library?
>> Thank you in advance.
> Tal Beno.
--
Eric Joe
Network Operations
Journey's End Internet/Computer Connection Inc